Overview

overview

10

Static

static

10

D5f0a5d17c...76.exe

windows7-x64

10

D5f0a5d17c...76.exe

windows10-1703-x64

10

D5f0a5d17c...76.exe

windows10-2004-x64

10

D5f0a5d17c...76.exe

windows11-21h2-x64

10

Resubmissions

10/04/2024, 02:29

240410-cy22baca5410

10/04/2024, 02:29

240410-cy2esafc8z10

10/04/2024, 02:29

240410-cy1s9aca5210

10/04/2024, 02:29

240410-cy1hgsfc8x10

14/10/2023, 01:29

231014-bwm9pshg4t10

Analysis

  • max time kernel
    1798s
  • max time network
    1800s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 02:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    D5f0a5d17c7420fe49da676.exe
  • Size 250KB
  • Sample240410-cy22baca54
  • SHA256 67474d56996cadf242c087aeac455357bd33e79545538eeade15ae259fb3e869
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
gurcucollectiondiscoveryspywarestealer

Malware Config

Signatures

  • Detect Gurcu Stealer V3 payload 3 IoCs
  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Checks computer location settings 2 TTPs 32 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 62 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 64 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 27 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\D5f0a5d17c7420fe49da676.exe
    "C:\Users\Admin\AppData\Local\Temp\D5f0a5d17c7420fe49da676.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "D5f0a5d17c7420fe49da676" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\D5f0a5d17c7420fe49da676.exe" &&START "" "C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3408
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:1292
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:4468
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "D5f0a5d17c7420fe49da676" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:2424
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          "C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3944
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp53EC.tmp" -C "C:\Users\Admin\AppData\Local\6rfb5r0uff"
            4⤵
              PID:1756
            • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
              "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:4840
      • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:736
        • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4848
      • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4436
        • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3016
      • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1928
        • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2944
      • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1292
        • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1884
      • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4976
        • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2016
      • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2836
        • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3624
      • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1704
        • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1992
      • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4992
        • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2176
      • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:512
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
        1⤵
          PID:4492
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k UnistackSvcGroup
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3652
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:960
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:1088
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2028
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:1244
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3408
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2396
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4800
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:3488
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4044
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:5000
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4156
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:1456
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:752
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4416
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:208
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:1644
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2788
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2116
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3476
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2276
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3528
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2464
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2960
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:3264
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2708
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4920
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1800
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4984
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4016
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2208
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2728
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2748
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4536
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4728
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3248
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2456
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3076
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4852
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3932
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4856
        • C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:1284
          • C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
            "C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:3260

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              cached-microdesc-consensus.tmp
              • Path C:\Users\Admin\AppData\Local\6rfb5r0uff\data\cached-microdesc-consensus.tmp
              • Size 2.7MB
              • SHA256 60b43cdce0f807f7891521f396f53def34a7d98986dbde0faa2a197189c587f3
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              cached-microdescs.new
              • Path C:\Users\Admin\AppData\Local\6rfb5r0uff\data\cached-microdescs.new
              • Size 10.2MB
              • SHA256 7b064cdcf01293e6d9c95df52d47ed5161c620142b1eb458d4f5189c3d3f53db
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              hostname
              • Path C:\Users\Admin\AppData\Local\6rfb5r0uff\host\hostname
              • Size 64B
              • SHA256 1b86f66fa075850e2d265003668f13f9ba14334fe0868cd29b9e1cd1076395c9
              • MD5 SHA1 SHA512
              Submit Download

              port.dat
              • Path C:\Users\Admin\AppData\Local\6rfb5r0uff\port.dat
              • Size 4B
              • SHA256 322ac9c5f39fcb8a5cf2d3ad558913ad6b056d8093c50704dda0215ee11c2a3a
              • MD5 SHA1 SHA512
              Submit Download

              tor.exe
              • Path C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
              • Size 7.4MB
              • SHA256 46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              tor.exe
              • Path C:\Users\Admin\AppData\Local\6rfb5r0uff\tor\tor.exe
              • Size 3.6MB
              • SHA256 527c2c8bf389a80dd0dcad4028283c51aaffdce19ce34dd04a26dc3704fbdf44
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              torrc.txt
              • Path C:\Users\Admin\AppData\Local\6rfb5r0uff\torrc.txt
              • Size 218B
              • SHA256 09c5366ab4459b8ee30d023a7c8eaa26f22c8f511929f2f4832a6908bb4da396
              • MD5 SHA1 SHA512
              Submit Download

              D5f0a5d17c7420fe49da676.exe
              • Path C:\Users\Admin\AppData\Local\EsetSecurity\D5f0a5d17c7420fe49da676.exe
              • Size 250KB
              • SHA256 67474d56996cadf242c087aeac455357bd33e79545538eeade15ae259fb3e869
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              D5f0a5d17c7420fe49da676.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\D5f0a5d17c7420fe49da676.exe.log
              • Size 1KB
              • SHA256 6da862f7c7feffca99cd58712ece93928c6ca6aed617f5d8c10a4718eaa2a910
              • MD5 SHA1 SHA512
              Submit Download

              installUtilLog.txt
              • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
              • Size 354B
              • SHA256 262eaf9fb99aa5862690db8aecb0cd023615bdc17d5f0704d3eba400257ae6b0
              • MD5 SHA1 SHA512
              Submit Download

              installUtilLog.txt
              • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
              • Size 472B
              • SHA256 1098516e87aee8468bddbfffbdd7042871508d251d53be99a7cfa2407fdb1c08
              • MD5 SHA1 SHA512
              Submit Download

              installUtilLog.txt
              • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
              • Size 590B
              • SHA256 75eaaacc6065d0132cb37dfe11ed6c17aaf657bbf7f547dc4b783e30787863d8
              • MD5 SHA1 SHA512
              Submit Download

              installUtilLog.txt
              • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
              • Size 708B
              • SHA256 ce435ed31283c5aa4ef8646cdb919448dc0ccd8ed306701119fe9853caacb1d0
              • MD5 SHA1 SHA512
              Submit Download

              installUtilLog.txt
              • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
              • Size 944B
              • SHA256 18fdda5909c0c784818964f059129be403315be985790b920e9ff0444cb3da3f
              • MD5 SHA1 SHA512
              Submit Download

              installUtilLog.txt
              • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
              • Size 1KB
              • SHA256 6b91745cf2e3b3b63d893428193851a1da9b17b91097a62b0cbe71e9f0fe2d9a
              • MD5 SHA1 SHA512
              Submit Download

              installUtilLog.txt
              • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
              • Size 1KB
              • SHA256 844ce07ab9f28d9bb95abc8f8ba8bb7c951d1b99d2ac9344907d8c45d6613084
              • MD5 SHA1 SHA512
              Submit Download

              installUtilLog.txt
              • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
              • Size 1KB
              • SHA256 4dce7310000adabab01fa00a8ca8d0412771f033d3caf00ba828c1802c2b3208
              • MD5 SHA1 SHA512
              Submit Download

              installUtilLog.txt
              • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
              • Size 1KB
              • SHA256 d0c33445ac86c9a5c4bba33d4cf189be62efeeb38165734585a55616bb12c20d
              • MD5 SHA1 SHA512
              Submit Download

              installUtilLog.txt
              • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
              • Size 1KB
              • SHA256 6f8acd8ef31cbb0faa560c431846893ad27bf71bd00dfb18f4f9f33ad52a23f7
              • MD5 SHA1 SHA512
              Submit Download

              installUtilLog.txt
              • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
              • Size 1KB
              • SHA256 ac014f68c763810f7f595d2a2635be76e056ac1e527b46f6ede1d674653882c0
              • MD5 SHA1 SHA512
              Submit Download

              installUtilLog.txt
              • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
              • Size 1KB
              • SHA256 6557edee57aa2d4a87ba92ba460337297beb18e936a9559746aa8b0265478d0a
              • MD5 SHA1 SHA512
              Submit Download

              installUtilLog.txt
              • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
              • Size 1KB
              • SHA256 b47fe1b69670fcff6047ea9ed9f33ed65e0f052529189200b1998e6b12ce140a
              • MD5 SHA1 SHA512
              Submit Download

              installUtilLog.txt
              • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
              • Size 2KB
              • SHA256 6fdd2e02375c452fcb4fcd5535af8b04a50e141c40f1b2c7a8309732d59f87e0
              • MD5 SHA1 SHA512
              Submit Download

              installUtilLog.txt
              • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
              • Size 236B
              • SHA256 3b30e06cc90987a67194f887c8b4567dc039d6c4fa1e07bd5929cefc7649ca33
              • MD5 SHA1 SHA512
              Submit Download

              tmp53EC.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\tmp53EC.tmp
              • Size 13.3MB
              • SHA256 b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/208-318-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/208-314-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/736-51-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/736-41-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/736-42-0x00000236CE4C0000-0x00000236CE4D0000-memory.dmp
              Download

              memory/752-304-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/752-300-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/960-217-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/960-221-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/1208-2-0x000002770B320000-0x000002770B330000-memory.dmp
              Download

              memory/1208-1-0x00007FFBEEC90000-0x00007FFBEF751000-memory.dmp
              Download

              memory/1208-6-0x00007FFBEEC90000-0x00007FFBEF751000-memory.dmp
              Download

              memory/1208-0-0x000002770AF20000-0x000002770AF64000-memory.dmp
              Download

              memory/1292-108-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/1292-112-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/1704-146-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/1704-142-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/1800-384-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/1800-382-0x00000204B29B0000-0x00000204B29C0000-memory.dmp
              Download

              memory/1800-381-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/1928-101-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/1928-106-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/1928-102-0x000001E4A8C20000-0x000001E4A8C30000-memory.dmp
              Download

              memory/2024-162-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/2024-166-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/2028-232-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/2028-228-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/2708-370-0x000002B4D8040000-0x000002B4D8050000-memory.dmp
              Download

              memory/2708-372-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/2708-369-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/2788-324-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/2788-328-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/2836-132-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/2836-128-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/2960-358-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/2960-360-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/3408-242-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/3408-243-0x0000026A8E690000-0x0000026A8E6A0000-memory.dmp
              Download

              memory/3408-247-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/3476-338-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/3476-341-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/3528-347-0x000001D9B9090000-0x000001D9B90A0000-memory.dmp
              Download

              memory/3528-346-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/3528-349-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/3652-171-0x0000019FE4E40000-0x0000019FE4E50000-memory.dmp
              Download

              memory/3652-205-0x0000019FED2B0000-0x0000019FED2B1000-memory.dmp
              Download

              memory/3652-187-0x0000019FE4F40000-0x0000019FE4F50000-memory.dmp
              Download

              memory/3652-203-0x0000019FED280000-0x0000019FED281000-memory.dmp
              Download

              memory/3652-207-0x0000019FED3C0000-0x0000019FED3C1000-memory.dmp
              Download

              memory/3652-206-0x0000019FED2B0000-0x0000019FED2B1000-memory.dmp
              Download

              memory/3944-63-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/3944-12-0x0000021CA7290000-0x0000021CA72A0000-memory.dmp
              Download

              memory/3944-11-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/3944-64-0x0000021CA7290000-0x0000021CA72A0000-memory.dmp
              Download

              memory/4016-389-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/4016-391-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/4044-271-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/4044-275-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/4156-286-0x000001AA79F10000-0x000001AA79F20000-memory.dmp
              Download

              memory/4156-285-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/4156-290-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/4436-95-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/4436-91-0x000001F10FC40000-0x000001F10FC50000-memory.dmp
              Download

              memory/4436-90-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/4800-257-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/4800-261-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/4976-114-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/4976-118-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/4992-148-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download

              memory/4992-152-0x00007FFBEDAD0000-0x00007FFBEE591000-memory.dmp
              Download